CVE-2017-16962

CVE-2017-16962 describes multiple stored Cross-Site Scripting (XSS) vulnerabilities within the WebMail components (Crystal, pronto, and pronto4) of CommuniGate Pro versions prior to 6.2.1. These flaws allow attackers to inject malicious JavaScript through various vectors, including crafted calendar invitations, directory names, note names, task names, or malformed HTML emails. The vulnerability carries a CVSSv3 score of 6.1 (Medium), indicating a network-based attack requiring user interaction (UI:R) with low impact on confidentiality and integrity (C:L/I:L). While the attack complexity is low (AC:L), successful exploitation could lead to session hijacking, data theft, or defacement within the user's webmail interface. Currently, there is no evidence of widespread active exploitation, and it is not listed on the CISA KEV catalog. However, a public exploit (EDB-43177) exists on ExploitDB, demonstrating its feasibility. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant public attention.